{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,8]],"date-time":"2026-03-08T23:12:19Z","timestamp":1773011539926,"version":"3.50.1"},"reference-count":51,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,12,21]],"date-time":"2022-12-21T00:00:00Z","timestamp":1671580800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62071476"],"award-info":[{"award-number":["62071476"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Remote Sensing"],"abstract":"<jats:p>Recent studies have proven that synthetic aperture radar (SAR) automatic target recognition (ATR) models based on deep neural networks (DNN) are vulnerable to adversarial examples. However, existing attacks easily fail in the case where adversarial perturbations cannot be fully fed to victim models. We call this situation perturbation offset. Moreover, since background clutter takes up most of the area in SAR images and has low relevance to recognition results, fooling models with global perturbations is quite inefficient. This paper proposes a semi-white-box attack network called Universal Local Adversarial Network (ULAN) to generate universal adversarial perturbations (UAP) for the target regions of SAR images. In the proposed method, we calculate the model\u2019s attention heatmaps through layer-wise relevance propagation (LRP), which is used to locate the target regions of SAR images that have high relevance to recognition results. In particular, we utilize a generator based on U-Net to learn the mapping from noise to UAPs and craft adversarial examples by adding the generated local perturbations to target regions. Experiments indicate that the proposed method effectively prevents perturbation offset and achieves comparable attack performance to conventional global UAPs by perturbing only a quarter or less of SAR image areas.<\/jats:p>","DOI":"10.3390\/rs15010021","type":"journal-article","created":{"date-parts":[[2022,12,21]],"date-time":"2022-12-21T05:42:53Z","timestamp":1671601373000},"page":"21","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6949-1125","authenticated-orcid":false,"given":"Meng","family":"Du","sequence":"first","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}]},{"given":"Daping","family":"Bi","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1369-7818","authenticated-orcid":false,"given":"Mingyang","family":"Du","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8743-1684","authenticated-orcid":false,"given":"Xinsong","family":"Xu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}]},{"given":"Zilong","family":"Wu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}]}],"member":"1968","published-online":{"date-parts":[[2022,12,21]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"2115","DOI":"10.1109\/JSTARS.2017.2787728","article-title":"Multiple mode SAR raw data simulation and parallel acceleration for Gaofen-3 mission","volume":"11","author":"Zhang","year":"2018","journal-title":"IEEE J. Sel. Top. Appl. Earth Obs. Remote Sens."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1109\/TAES.1967.5408745","article-title":"Synthetic aperture radar","volume":"AES-3","author":"Brown","year":"1967","journal-title":"IEEE Trans. Aerosp. Electron. Syst."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1109\/MGRS.2013.2248301","article-title":"A tutorial on synthetic aperture radar","volume":"1","author":"Moreira","year":"2013","journal-title":"IEEE Geosci. Remote Sens. Mag."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"7177","DOI":"10.1109\/TGRS.2017.2743222","article-title":"Complex-valued convolutional neural network and its application in polarimetric SAR image classification","volume":"55","author":"Zhang","year":"2017","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"4806","DOI":"10.1109\/TGRS.2016.2551720","article-title":"Target classification using the deep convolutional networks for SAR images","volume":"54","author":"Chen","year":"2016","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_6","first-page":"364","article-title":"Convolutional neural network with data augmentation for SAR target recognition","volume":"13","author":"Ding","year":"2016","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"176","DOI":"10.1016\/j.sigpro.2019.01.006","article-title":"Factorized discriminative conditional variational auto-encoder for radar HRRP target recognition","volume":"158","author":"Du","year":"2019","journal-title":"Signal Process."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Vint, D., Anderson, M., Yang, Y., Ilioudis, C., Di Caterina, G., and Clemente, C. (2021). Automatic Target Recognition for Low Resolution Foliage Penetrating SAR Images Using CNNs and GANs. Remote Sens., 13.","DOI":"10.3390\/rs13040596"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"102632","DOI":"10.1016\/j.jnca.2020.102632","article-title":"Adversarial attacks on deep-learning-based SAR image target recognition","volume":"162","author":"Huang","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_10","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_11","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial examples in the physical world. Artificial Intelligence Safety and Security, Chapman and Hall\/CRC.","DOI":"10.1201\/9781351251389-8"},{"key":"ref_13","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (July, January 26). Deepfool: A simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2016, January 21\u201324). The limitations of deep learning in adversarial settings. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), Saarbr\u00fccken, Germany.","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","article-title":"One pixel attack for fooling deep neural networks","volume":"23","author":"Su","year":"2019","journal-title":"IEEE Trans. Evol. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.J. (2017, January 3). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Dallas, TX, USA.","DOI":"10.1145\/3128572.3140448"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Chen, J., Jordan, M.I., and Wainwright, M.J. (2020, January 18\u201321). Hopskipjumpattack: A query-efficient decision-based attack. Proceedings of the 2020 IEEE Symposium on Security and Privacy (sp), San Francisco, CA, USA.","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., and Yuille, A.L. (2019, January 15\u201319). Improving transferability of adversarial examples with input diversity. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Hayes, J., and Danezis, G. (2018, January 24). Learning universal adversarial perturbations with generative models. Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW.2018.00015"},{"key":"ref_21","unstructured":"Mopuri, K.R., Garg, U., and Babu, R.V. (2017). Fast feature fool: A data independent approach to universal adversarial perturbations. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Mopuri, K.R., Uppala, P.K., and Babu, R.V. (2018, January 8\u201314). Ask, acquire, and attack: Data-free uap generation using class impressions. Proceedings of the European Conference on Computer Vision (ECCV), Munich, German.","DOI":"10.1007\/978-3-030-01240-3_2"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1604","DOI":"10.1109\/TGRS.2020.2999962","article-title":"Assessing the threat of adversarial examples on deep neural networks for remote sensing scene classification: Attacks and defenses","volume":"59","author":"Xu","year":"2020","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_24","first-page":"1","article-title":"Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark","volume":"60","author":"Xu","year":"2022","journal-title":"IEEE Trans. Geosci. Remote Sens."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Thys, S., Van Ranst, W., and Goedem\u00e9, T. (2019, January 16\u201317). Fooling automated surveillance cameras: Adversarial patches to attack person detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops, Long Beach, CA, USA.","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1333","DOI":"10.1109\/JSTARS.2020.3038683","article-title":"Adversarial examples for CNN-based SAR image classification: An experience study","volume":"14","author":"Li","year":"2020","journal-title":"IEEE J. Sel. Top. Appl. Earth Obs. Remote Sens."},{"key":"ref_27","first-page":"1","article-title":"Fast C&W: A Fast Adversarial Attack Algorithm to Fool SAR Target Recognition with Deep Convolutional Neural Networks","volume":"19","author":"Du","year":"2021","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Wang, L., Wang, X., Ma, S., and Zhang, Y. (2021, January 7\u201310). Universal adversarial perturbation of SAR images for deep learning based target classification. Proceedings of the 2021 IEEE 4th International Conference on Electronics Technology (ICET), Chengdu, China.","DOI":"10.1109\/ICET51757.2021.9450944"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Xia, W., Liu, Z., and Li, Y. (2022). SAR-PeGA: A Generation Method of Adversarial Examples for SAR Image Target Recognition Network. IEEE Trans. Aerosp. Electron. Syst., 1\u201311.","DOI":"10.1109\/TAES.2022.3206261"},{"key":"ref_30","first-page":"2188","article-title":"Universal adversarial attack on attention and the resulting dataset damagenet","volume":"44","author":"Chen","year":"2020","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Bach, S., Binder, A., Montavon, G., Klauschen, F., M\u00fcller, K.R., and Samek, W. (2015). On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PLoS ONE, 10.","DOI":"10.1371\/journal.pone.0130140"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Xiao, C., Li, B., Zhu, J.Y., He, W., Liu, M., and Song, D. (2018). Generating adversarial examples with adversarial networks. arXiv.","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Ronneberger, O., Fischer, P., and Brox, T. (2015, January 5\u20139). U-net: Convolutional networks for biomedical image segmentation. Proceedings of the International Conference on Medical Image Computing and Computer-Assisted Intervention, Munich, Germany.","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Zeiler, M.D., and Fergus, R. (2014, January 6\u201312). Visualizing and understanding convolutional networks. Proceedings of the European Conference on Computer Vision, Zurich, Switzerland.","DOI":"10.1007\/978-3-319-10590-1_53"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"931","DOI":"10.1038\/nmeth.3547","article-title":"Predicting effects of noncoding variants with deep learning\u2013based sequence model","volume":"12","author":"Zhou","year":"2015","journal-title":"Nat. Methods"},{"key":"ref_36","unstructured":"Simonyan, K., Vedaldi, A., and Zisserman, A. (2013). Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"920","DOI":"10.1364\/JOSA.70.000920","article-title":"Image analysis via the general theory of moments","volume":"70","author":"Teague","year":"1980","journal-title":"Josa"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1109\/TSMC.1979.4310076","article-title":"A threshold selection method from gray-level histograms","volume":"9","author":"Otsu","year":"1979","journal-title":"IEEE Trans. Syst. Man Cybern."},{"key":"ref_39","first-page":"228","article-title":"MSTAR extended operating conditions: A tutorial","volume":"2757","author":"Keydel","year":"1996","journal-title":"Algorithms Synth. Aperture Radar Imag. III"},{"key":"ref_40","first-page":"11","article-title":"Sparse Adversarial Attack of SAR Image","volume":"37","author":"Junfan","year":"2021","journal-title":"J. Signal Process."},{"key":"ref_41","unstructured":"Simonyan, K., and Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., and Rabinovich, A. (2015, January 7\u201312). Going deeper with convolutions. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"ref_43","unstructured":"Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. (June, January 26). Rethinking the inception architecture for computer vision. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Xie, S., Girshick, R., Doll\u00e1r, P., Tu, Z., and He, K. (2017, January 21\u201326). Aggregated residual transformations for deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref_46","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Poursaeed, O., Katsman, I., Gao, B., and Belongie, S. (2018, January 18\u201323). Generative adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00465"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: From error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans. Image Process."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s11432-019-2772-5","article-title":"FUSAR-Ship: Building a high-resolution SAR-AIS matchup dataset of Gaofen-3 for ship detection and recognition","volume":"63","author":"Hou","year":"2020","journal-title":"Sci. China Inf. Sci."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"84","DOI":"10.1145\/3065386","article-title":"Imagenet classification with deep convolutional neural networks","volume":"60","author":"Krizhevsky","year":"2017","journal-title":"Commun. ACM"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.C. (2018, January 18\u201323). Mobilenetv2: Inverted residuals and linear bottlenecks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00474"}],"container-title":["Remote Sensing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2072-4292\/15\/1\/21\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:45:17Z","timestamp":1760147117000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2072-4292\/15\/1\/21"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,21]]},"references-count":51,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["rs15010021"],"URL":"https:\/\/doi.org\/10.3390\/rs15010021","relation":{"has-preprint":[{"id-type":"doi","id":"10.20944\/preprints202211.0243.v1","asserted-by":"object"}]},"ISSN":["2072-4292"],"issn-type":[{"value":"2072-4292","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,21]]}}}